unpublish cronjob uses anonymous credentials, therefore it doesn't affect nodes in restricted areas of the site.

steps to reproduce (in 4.x):

. configure article class in content.ini|UnpublishSettings|ClassList
. create an article and fill in unpublish_date field (to a date in the past)
. set the node section to restricted
. run "php runcronjobs.php" (unpublish.php will run)
. verify that the object was not affected

steps to reproduce (in 5.x):

. configure a class to have a datetime field with unpublish_date as identifier
. configure <your class> in content.ini|UnpublishSettings|ClassList
. create an <your class> and fill in unpublish_date field (to a date in the past)
. set the node section to restricted
. run "php runcronjobs.php" (unpublish.php will run)
. verify that the object was not affected